Extract from Rachel Marmor’s article “He’s Making a List. Will Regulators Check His Privacy Practices Twice?”
Santa’s practice of monitoring behavior of children across the globe has been publically disclosed for decades, but the recent implementation of the EU General Data Protection Regulation (GDPR) and enactment of the California Consumer Privacy Act (CCPA) raise new questions about the lawfulness of Santa’s activities and rights of children when it comes to collection of data about their activities, locations, and toy preferences. (The application of these laws to Santa’s elves in the employment context is beyond the scope of this article.) A look at Santa’s operations reveals many of the theoretical and practical challenges that businesses will continue to face throughout the new year as they seek to comply with an increasingly complex legal landscape.
